You may have heard of patient portals, which allow the secure transmission of documents between providers and patients through a secure cloud-based browser application. As a result, there are several options to avoid this: In short, simply attaching your patient’s medical documents to an email and sending it to a law firm very well may be a HIPAA violation.

That means you may be exposing your documents to a security vulnerability if you send documents through Gmail. While Gmail encrypts your emails while they are on your computer or server, that encryption does not extend to the recipient’s computer or server unless they are also using a Gmail account. Making sure that the contents of the email are encrypted at each stage is called end-to-end encryption. When you send a document via email, there are four locations for a hacker to intercept it: your computer, the recipient’s computer, your email server, and the recipient’s email server. ”Įncryption is the process of converting a message into code so that hackers cannot steal it while it travels from your email provider’s domain through the intraweb to the recipient. Due to the substantial development and maintenance costs which can be associated with custom encryption solutions, I frequently recommend clients look for plug and play solutions with reputable providers that can provide security at a reasonable cost. This is due to two main reasons: (i) increased risks of data breaches due to hacking, ph ishing, and related digital attacks and (ii) the 2019 enforcement discretion ruling from Use Department of Health and Human Services which has increasing caps on penalties for providers for violation of HIPAA based on the level of culpability. Prominent HIPAA healthcare attorney Vinay Bhupathy of Sheppard Mullin: “I advise my medical provider clients not to use the standard GMAIL, AOL, or other non-encrypted email services to send patients health records. Yahoo, and other common standard email services do not meet. This is sometimes misinterpreted as simply requiring password protection on email accounts in reality, the encryption standard is a much higher level of security, one that Gmail, AOL. When transmitting medical documents, medical providers are required to “implement a mechanism to encrypt electronic protected health information” or install an equivalent measure of data security. A common question is whether emailing documents through a standard email service like Gmail or AOL is in keeping with the data encryption standards outlined in HIPAA’s Security Rule. Personal injury law firms often request bills and records for a patient in order to pursue their legal case, leaving providers to find a HIPAA-compliant way to transmit these documents. Here’s the long answer.įor medical providers, one of the biggest headaches in HIPAA compliance is sending private medical documents to external parties who are entitled to receive them.

Hippa secure email solutions